feat(passkey): SHORTCAKE_PASSKEY companion linking

src/client.rs

@@ -560,6 +560,15 @@ pub struct Client {
     /// Tracks the pending pair code request and ephemeral keys.
     pub(crate) pair_code_state: Arc<Mutex<wacore::pair_code::PairCodeState>>,
 
+    /// SHORTCAKE_PASSKEY linking flow state: the pending handoff key, the
+    /// per-attempt ephemeral linking cache, and the optional host authenticator.
+    pub(crate) passkey_state: Arc<Mutex<crate::passkey::flow::PasskeyFlowState>>,
+
+    /// Wait-free "an open is in flight" reservation for the passkey flow. Kept
+    /// outside `passkey_state` so it can be released synchronously on drop (a
+    /// cancelled open can't leave it stuck), unlike a flag behind the async lock.
+    pub(crate) passkey_opening: AtomicBool,
+
     /// Custom handlers for encrypted message types. Set once at `Bot::build` and
     /// immutable afterward, so the receive hot path reads it with a plain
     /// `OnceLock::get` (no lock) and no per-node guard acquisition.

src/client/lifecycle.rs

@@ -225,6 +225,8 @@ impl Client {
             major_sync_task_sender: tx,
             pairing_cancellation_tx: Arc::new(Mutex::new(None)),
             pair_code_state: Arc::new(Mutex::new(wacore::pair_code::PairCodeState::default())),
+            passkey_state: Arc::new(Mutex::new(crate::passkey::flow::PasskeyFlowState::default())),
+            passkey_opening: AtomicBool::new(false),
             custom_enc_handlers: std::sync::OnceLock::new(),
             inbound_durability_hook: std::sync::OnceLock::new(),
             chatstate_handlers: Arc::new(RwLock::new(Vec::new())),

src/handlers/notification/mod.rs

@@ -61,6 +61,12 @@ async fn handle_notification_impl(client: &Arc<Client>, node: Arc<OwnedNodeRef>)
         "disappearing_mode" => handle_disappearing_mode_notification(client, nr),
         "newsletter" => handle_newsletter_notification(client, Arc::clone(&node)),
         "mex" => handle_mex_notification(client, nr),
+        crate::passkey::flow::NOTIF_PASSKEY_REQUEST => {
+            crate::passkey::flow::handle_passkey_notification(client, Arc::clone(&node)).await;
+        }
+        crate::passkey::flow::NOTIF_PASSKEY_CONTINUATION => {
+            crate::passkey::flow::handle_passkey_continuation(client, Arc::clone(&node)).await;
+        }
         "mediaretry" => {
             debug!(
                 "Received mediaretry notification for msg {}",

src/lib.rs

@@ -63,6 +63,7 @@ pub mod message;
 pub(crate) mod msg_secret_buffer;
 pub mod pair;
 pub mod pair_code;
+pub mod passkey;
 pub mod request;
 pub use request::IqError;
 #[cfg(feature = "tokio-runtime")]

src/pair.rs

@@ -180,8 +180,7 @@ async fn handle_pair_success<'a>(
         }
     };
 
-    let device_identity_node = success_node.get_optional_child_by_tag(&["device-identity"]);
-    let device_identity_bytes = match device_identity_node.and_then(|n| n.content_bytes()) {
+    let device_identity_bytes = match PairUtils::extract_device_identity_bytes(success_node) {
         Some(b) => b,
         None => {
             let error_node = PairUtils::build_pair_error_node(&req_id, 500, "internal-error");